{
 "tag": "pypi",
 "name": "PyPI",
 "group": "Platforms & channels",
 "incidents": [
  {
   "slug": "trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026",
   "title": "TrapDoor packages on npm, PyPI and Crates.io steal wallet data and plant hidden prompts for AI coding tools",
   "url": "https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026",
   "json": "https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The packages planted .cursorrules and CLAUDE.md files with hidden Unicode instructions meant to trick AI coding assistants into running steps that could find and exfiltrate secrets."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "Developers installing packages from npm, PyPI and Crates.io",
   "tags": [
    "multi-evm",
    "supply-chain",
    "trapdoor",
    "npm",
    "pypi",
    "crates-io",
    "ai-coding-agent",
    "cursor",
    "claude-code",
    "hidden-unicode",
    "infostealer",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-05-26",
   "closedAt": "2026-05-26",
   "updatedAt": "2026-05-26T12:00:00Z",
   "summary": "Socket reported in late May 2026 a campaign it named TrapDoor: more than 34 malicious packages and 384+ related versions across npm, PyPI and Crates.io that steal crypto wallet data and other developer secrets. The packages also tried to alter files that AI coding tools read, such as .cursorrules and CLAUDE.md, using hidden Unicode instructions meant to get the assistant to run scan-like steps that find and send out secrets. No confirmed losses or victim counts have been published. Developers who installed flagged packages should rotate credentials and move wallet funds."
  },
  {
   "slug": "latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026",
   "title": "Solana wallet MCP server on PyPI sent users' private keys to a remote server",
   "url": "https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026",
   "json": "https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The package was an MCP wallet server for AI agents; it auto-registered itself as an MCP server for Claude and sent the Solana private key to a remote server."
   },
   "chains": [
    "solana"
   ],
   "method": "supply-chain",
   "product": "latinum-wallet-mcp (PyPI)",
   "tags": [
    "solana",
    "supply-chain",
    "mcp",
    "mcp-server",
    "pypi",
    "claude",
    "ai-agent",
    "private-key",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-03-31",
   "closedAt": "2026-03-31",
   "updatedAt": "2026-03-31T12:00:00Z",
   "summary": "An advisory published on 31 March 2026 flagged latinum-wallet-mcp, a PyPI package that runs a Solana wallet as an MCP server for AI agents, as malicious. From version 0.0.32 it sent the wallet's private key, along with other metrics, to a remote server during wallet setup, and from 0.0.34 it added itself as an MCP server for Claude on import; none of this was in the public GitHub code. Versions 0.0.32 to 0.0.36 are listed as affected. Anyone who installed them should treat that Solana key as stolen and move funds to a new wallet."
  },
  {
   "slug": "litellm-pypi-teampcp-credential-wallet-stealer-mar-2026",
   "title": "Compromised LiteLLM releases on PyPI steal cloud keys and crypto wallet data from AI developers",
   "url": "https://drains.watch/i/litellm-pypi-teampcp-credential-wallet-stealer-mar-2026",
   "json": "https://drains.watch/i/litellm-pypi-teampcp-credential-wallet-stealer-mar-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The trojanized package was LiteLLM, a gateway library used to connect AI apps and agents to LLMs, so an AI tool was the delivery route; no AI model was manipulated."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "LiteLLM on PyPI",
   "tags": [
    "multi-evm",
    "supply-chain",
    "litellm",
    "pypi",
    "teampcp",
    "llm-gateway",
    "ai-tooling",
    "infostealer",
    "trivy",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-03-24",
   "closedAt": "2026-03-24",
   "updatedAt": "2026-03-24T12:00:00Z",
   "summary": "On 24 March 2026 attackers tracked as TeamPCP published LiteLLM 1.82.7 and 1.82.8 to PyPI with hidden code that runs on import, and in 1.82.8 whenever Python starts. LiteLLM is a popular open-source gateway that AI apps and agents use to reach many LLM providers, with over 3.4 million downloads a day. The payload collected SSH keys, cloud credentials, Kubernetes secrets, .env files and crypto wallet data and sent them to a lookalike domain. Both versions were removed; anyone who installed them should rotate secrets and move funds from wallets on affected machines."
  },
  {
   "slug": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "title": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent",
   "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "json": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The malicious dependency entered an AI trading agent through a commit co-authored by Claude Opus, and ReversingLabs assesses the attackers wrote promotional package pages to lure AI coding agents."
   },
   "chains": [
    "solana"
   ],
   "method": "supply-chain",
   "product": "AI trading agent projects and Web3 developers on npm",
   "tags": [
    "solana",
    "supply-chain",
    "npm",
    "pypi",
    "ai-coding-agent",
    "claude",
    "ai-trading-bot",
    "famous-chollima",
    "north-korea",
    "dprk",
    "promptmink",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-28",
   "closedAt": "2026-04-29",
   "updatedAt": "2026-04-29T12:00:00Z",
   "summary": "ReversingLabs reported on 29 April 2026 that a 28 February commit to openpaw-graveyard, an autonomous crypto trading agent built for Solana, was co-authored by Claude Opus and added a bait package (@solana-launchpad/sdk) that silently pulled in the malicious @validate-sdk/v2. The payload steals .env and JSON files and crypto wallet credentials, and adds attacker SSH keys for remote access. ReversingLabs ties the campaign, 60+ packages and 300+ versions over about seven months, to North Korea's Famous Chollima and believes it deliberately targets AI coding agents. No losses were reported; check lockfiles for the named packages and rotate keys on affected machines."
  }
 ],
 "changes": [
  {
   "incident": "trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026",
   "incidentTitle": "TrapDoor packages on npm, PyPI and Crates.io steal wallet data and plant hidden prompts for AI coding tools",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-26",
   "title": "CSO Online reported Socket's TrapDoor findings: 34+ malicious packages across three registries that steal wallet data and poison AI assistant config files.",
   "sourceUrl": "https://www.csoonline.com/article/4177019/trapdoor-malware-campaign-puts-developer-workstations-in-ciso-spotlight.html",
   "url": "https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026"
  },
  {
   "incident": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "incidentTitle": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-29",
   "title": "ReversingLabs published its findings and linked the campaign to Famous Chollima.",
   "sourceUrl": "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto",
   "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026"
  },
  {
   "incident": "latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026",
   "incidentTitle": "Solana wallet MCP server on PyPI sent users' private keys to a remote server",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-31",
   "title": "Malicious-package advisory MAL-2026-2315 was published for latinum-wallet-mcp versions 0.0.32 to 0.0.36.",
   "sourceUrl": "https://osv.dev/vulnerability/MAL-2026-2315",
   "url": "https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026"
  },
  {
   "incident": "litellm-pypi-teampcp-credential-wallet-stealer-mar-2026",
   "incidentTitle": "Compromised LiteLLM releases on PyPI steal cloud keys and crypto wallet data from AI developers",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-03-24",
   "title": "Malicious LiteLLM 1.82.7 and 1.82.8 were published to PyPI with a credential and wallet stealer, and were later removed.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/popular-litellm-pypi-package-compromised-in-teampcp-supply-chain-attack/",
   "url": "https://drains.watch/i/litellm-pypi-teampcp-credential-wallet-stealer-mar-2026"
  },
  {
   "incident": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "incidentTitle": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-02-28",
   "title": "A commit co-authored by Claude Opus added @solana-launchpad/sdk to the openpaw-graveyard trading agent, pulling in the malicious @validate-sdk/v2.",
   "sourceUrl": "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto",
   "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026"
  }
 ]
}